CVE-2026-33281: Ella Core panics on invalid PDU Session IDs in NGAP messages

March 19, 2026 (updated March 25, 2026)

Ella Core panics when processing NGAP messages with invalid PDU Session IDs outside of 1-15.

References

github.com/advisories/GHSA-q669-4gmv-g8mf
github.com/ellanetworks/core
github.com/ellanetworks/core/security/advisories/GHSA-q669-4gmv-g8mf
nvd.nist.gov/vuln/detail/CVE-2026-33281

Code Behaviors & Features

Detect and mitigate CVE-2026-33281 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →